Unscored severity · published May 3, 2005
CVE-2005-1381
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Webcache 9i allow remote attackers to inject arbitrary web script or HTML via the (1) cache_dump_file or (2)…
–
CVSS
20.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Webcache 9i allow remote attackers to inject arbitrary web script or HTML via the (1) cache_dump_file or (2) PartialPageErrorPage parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)20.2% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Application Server Web Cache · Oracle
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-1381
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-1381
marc.info
http://marc.info/?l=bugtraq&m=111472423409560&w=2
Vendor Advisory
http://secunia.com/advisories/15143
Vendor Advisory
http://www.osvdb.org/15910
Exploit
http://www.red-database-security.com/advisory/oracle_webcache_CSS_vulnerabilities.html
Exploit
http://www.securityfocus.com/bid/13421
Exploit
http://www.securityfocus.com/bid/13422
More from Application Server Web Cache
–
CVE-2005-1382
The webcacheadmin module in Oracle Webcache 9i allows remote attackers to corrupt arbitrary files via a full pathname in the cache_dump_file parameter
–
CVE-2004-0385
Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0, and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long…
–
CVE-2002-0561
The default configuration of the PL/SQL Gateway web administration interface in Oracle 9i Application Server 1.0.2.x uses null authentication, which allows remote attackers to…
–
CVE-2002-0562
The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain…
–
CVE-2002-0559
Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long…